Accidential exposure of private GraphQL fields